Explorer.exe crash

matthieugd · 09-11-2012, 12:33 PM

Hello,

I'm using Display Link to connect another monitor trough USB on my MacBook Air 2012 with Windows 8 RTM. With one software (Resharper 7, a plug-in for Visual Studio 2012 RTM) I got an explorer.exe crash during some autocompletion process. Here are the details below. I saw the dlumd64.dll in the dump analysis so maybe it's related to DL? My version installed is 7.0.39973.0 (Core) / 7.0.39857.0 (Graphics) downloaded from the website.

Here' s a link to the dump file : http://sdrv.ms/U0KZYP

Faulting application name: explorer.exe, version: 6.2.9200.16384, time stamp: 0x50107dbc

Faulting module name: twinui.dll, version: 6.2.9200.16384, time stamp: 0x50109442

Exception code: 0xc0000005

Fault offset: 0x0000000000340849

Faulting process id: 0x4c

Faulting application start time: 0x01cd8d1ad64a50fe

Faulting application path: C:\Windows\explorer.exe

Faulting module path: C:\Windows\System32\twinui.dll

Report Id: 349721e8-f91b-11e1-be6a-d03a544d1928

Faulting package full name:

Faulting package-relative application ID:

--------------------------------------------------

Microsoft (R) Windows Debugger Version 6.2.9200.16384 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\LocalDumps\explorer.exe.76.dmp]
User Mini Dump File with Full Memory: Only application data is available

Symbol search path is: srv*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\LocalDumps
Windows 8 Version 9200 MP (4 procs) Free x64
Product: WinNt, suite: SingleUserTS
Built by: 6.2.9200.16384 (win8_rtm.120725-1247)
Machine Name:
Debug session time: Fri Sep 7 14:38:26.000 2012 (UTC - 4:00)
System Uptime: 0 days 4:11:14.585
Process Uptime: 0 days 1:34:00.000
.................................................. ..............
.................................................. ..............
.................................................. ..............
............................
Loading unloaded module list
.................................................. ..............
This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(4c.17a0): Access violation - code c0000005 (first/second chance not available)
ntdll!NtWaitForMultipleObjects+0xa:
000007ff`514a315b c3 ret
0:004> !analyze -v
************************************************** *****************************
* *
* Exception Analysis *
* *
************************************************** *****************************

*** ERROR: Symbol file could not be found. Defaulted to export symbols for sppc.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for dlumd64.dll -

FAULTING_IP:
twinui!CApplicationManager::_TryChangeSystemModeDe sktop+29 [d:\w8rtm\shell\twinui\appmanager\lib\appmanager.cp p @ 4999]
000007ff`3c8f0849 488b07 mov rax,qword ptr [rdi]

EXCEPTION_RECORD: ffffffffffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 000007ff3c8f0849 (twinui!CApplicationManager::_TryChangeSystemModeD esktop+0x0000000000000029)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 0000000000000000
Attempt to read from address 0000000000000000

DEFAULT_BUCKET_ID: WRONG_SYMBOLS

PROCESS_NAME: explorer.exe

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1: 0000000000000000

EXCEPTION_PARAMETER2: 0000000000000000

READ_ADDRESS: 0000000000000000

FOLLOWUP_IP:
twinui!CApplicationManager::_TryChangeSystemModeDe sktop+29 [d:\w8rtm\shell\twinui\appmanager\lib\appmanager.cp p @ 4999]
000007ff`3c8f0849 488b07 mov rax,qword ptr [rdi]

NTGLOBALFLAG: 0

APPLICATION_VERIFIER_FLAGS: 0

APP: explorer.exe

FAULTING_LOCAL_VARIABLE_NAME: hwndZbidDesktop

MANAGED_STACK: !dumpstack -EE
No export dumpstack found

PRIMARY_PROBLEM_CLASS: WRONG_SYMBOLS

BUGCHECK_STR: APPLICATION_FAULT_WRONG_SYMBOLS

LAST_CONTROL_TRANSFER: from 000007ff3c9cddb5 to 000007ff3c8f0849

STACK_TEXT:
00000000`03acf390 000007ff`3c9cddb5 : 00000000`03acf480 00000000`03acf500 00000000`00000001 00000000`00000001 : twinui!CApplicationManager::_TryChangeSystemModeDe sktop+0x29
00000000`03acf3e0 000007ff`3c5f544d : 00000000`0000001e 00000000`03acf540 00000000`00000000 00000000`00000000 : twinui!CApplicationManager::_HandleWindowChangedOw ner+0x3d8955
00000000`03acf440 000007ff`3c5b232a : 00000000`00000001 00000000`00050216 00000000`0000c02b 000007ff`3c5b1820 : twinui!CApplicationManager::OnShellHookMessage+0x4 26
00000000`03acf720 000007ff`4f93171e : 00000000`00050216 00000000`0000c02b 00000000`0000001e 00000000`0036069e : twinui!CImmersiveWindowMessageService::s_MessageMs gWndProc+0x336
00000000`03acf830 000007ff`4f9314d7 : 00000000`008311c0 00000000`03acf9a0 000007f7`579e6800 000007ff`3c5b1ff0 : user32!UserCallWinProcCheckWow+0x13a
00000000`03acf8f0 000007ff`4b981264 : 00000000`0046cfa0 00000000`0046cfa0 00000000`00000000 00000000`00000000 : user32!DispatchMessageWorker+0x1a7
00000000`03acf970 000007ff`4b9835c0 : 00000000`00000045 00000000`00466d40 00000000`00000000 00000000`00000000 : windows_immersiveshell_serviceprovider!CImmersiveS hellController::_ImmersiveShellComponentsThreadPro cInternal+0x2a6
00000000`03acfa10 000007ff`4f7f167e : 000007ff`4b980000 00000000`00000000 00000000`00000000 00000000`00000000 : windows_immersiveshell_serviceprovider!CImmersiveS hellController::s_ImmersiveShellComponentsThreadPr oc+0x75
00000000`03acfa40 000007ff`514bc3f1 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : kernel32!BaseThreadInitThunk+0x1a
00000000`03acfa70 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x1d

STACK_COMMAND: ~4s; .ecxr ; kb

FAULTING_SOURCE_LINE: d:\w8rtm\shell\twinui\appmanager\lib\appmanager.cp p

FAULTING_SOURCE_FILE: d:\w8rtm\shell\twinui\appmanager\lib\appmanager.cp p

FAULTING_SOURCE_LINE_NUMBER: 4999

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: twinui!CApplicationManager::_TryChangeSystemModeDe sktop+29

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: twinui

IMAGE_NAME: twinui.dll

DEBUG_FLR_IMAGE_TIMESTAMP: 50109442

FAILURE_BUCKET_ID: WRONG_SYMBOLS_c0000005_twinui.dll!CApplicationMana ger::_TryChangeSystemModeDesktop

BUCKET_ID: APPLICATION_FAULT_WRONG_SYMBOLS_twinui!CApplicatio nManager::_TryChangeSystemModeDesktop+29

WATSON_STAGEONE_URL: http://watson.microsoft.com/StageOne...htm?Retriage=1

Followup: MachineOwner
---------

0:004> lmvm twinui
start end module name
000007ff`3c5b0000 000007ff`3cf57000 twinui (private pdb symbols) c:\symbols\twinui.pdb\4F7F380EBAD34576834CB628C754 C82E2\twinui.pdb
Loaded symbol image file: twinui.dll
Image path: C:\Windows\System32\twinui.dll
Image name: twinui.dll
Timestamp: Wed Jul 25 20:50:10 2012 (50109442)
CheckSum: 009A014E
ImageSize: 009A7000
File version: 6.2.9200.16384
Product version: 6.2.9200.16384
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: TWINUI
OriginalFilename: TWINUI.dll
ProductVersion: 6.2.9200.16384
FileVersion: 6.2.9200.16384 (win8_rtm.120725-1247)
FileDescription: TWINUI
LegalCopyright: © Microsoft Corporation. All rights reserved.

09-11-2012, 12:33 PM	#1
matthieugd Junior Member Join Date: Sep 2012 Posts: 1	Explorer.exe crash Hello, I'm using Display Link to connect another monitor trough USB on my MacBook Air 2012 with Windows 8 RTM. With one software (Resharper 7, a plug-in for Visual Studio 2012 RTM) I got an explorer.exe crash during some autocompletion process. Here are the details below. I saw the dlumd64.dll in the dump analysis so maybe it's related to DL? My version installed is 7.0.39973.0 (Core) / 7.0.39857.0 (Graphics) downloaded from the website. Here' s a link to the dump file : http://sdrv.ms/U0KZYP Faulting application name: explorer.exe, version: 6.2.9200.16384, time stamp: 0x50107dbc Faulting module name: twinui.dll, version: 6.2.9200.16384, time stamp: 0x50109442 Exception code: 0xc0000005 Fault offset: 0x0000000000340849 Faulting process id: 0x4c Faulting application start time: 0x01cd8d1ad64a50fe Faulting application path: C:\Windows\explorer.exe Faulting module path: C:\Windows\System32\twinui.dll Report Id: 349721e8-f91b-11e1-be6a-d03a544d1928 Faulting package full name: Faulting package-relative application ID: -------------------------------------------------- Microsoft (R) Windows Debugger Version 6.2.9200.16384 AMD64 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [C:\LocalDumps\explorer.exe.76.dmp] User Mini Dump File with Full Memory: Only application data is available Symbol search path is: srvc:\symbolshttp://msdl.microsoft.com/download/symbols Executable search path is: C:\LocalDumps Windows 8 Version 9200 MP (4 procs) Free x64 Product: WinNt, suite: SingleUserTS Built by: 6.2.9200.16384 (win8_rtm.120725-1247) Machine Name: Debug session time: Fri Sep 7 14:38:26.000 2012 (UTC - 4:00) System Uptime: 0 days 4:11:14.585 Process Uptime: 0 days 1:34:00.000 .................................................. .............. .................................................. .............. .................................................. .............. ............................ Loading unloaded module list .................................................. .............. This dump file has an exception of interest stored in it. The stored exception information can be accessed via .ecxr. (4c.17a0): Access violation - code c0000005 (first/second chance not available) ntdll!NtWaitForMultipleObjects+0xa: 000007ff`514a315b c3 ret 0:004> !analyze -v ************************************************ *************************** * * * Exception Analysis * * * ************************************************ ************************* * ERROR: Symbol file could not be found. Defaulted to export symbols for sppc.dll - *** ERROR: Symbol file could not be found. Defaulted to export symbols for dlumd64.dll - FAULTING_IP: twinui!CApplicationManager::_TryChangeSystemModeDe sktop+29 [d:\w8rtm\shell\twinui\appmanager\lib\appmanager.cp p @ 4999] 000007ff`3c8f0849 488b07 mov rax,qword ptr [rdi] EXCEPTION_RECORD: ffffffffffffffff -- (.exr 0xffffffffffffffff) ExceptionAddress: 000007ff3c8f0849 (twinui!CApplicationManager::_TryChangeSystemModeD esktop+0x0000000000000029) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 0000000000000000 Parameter[1]: 0000000000000000 Attempt to read from address 0000000000000000 DEFAULT_BUCKET_ID: WRONG_SYMBOLS PROCESS_NAME: explorer.exe ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. EXCEPTION_PARAMETER1: 0000000000000000 EXCEPTION_PARAMETER2: 0000000000000000 READ_ADDRESS: 0000000000000000 FOLLOWUP_IP: twinui!CApplicationManager::_TryChangeSystemModeDe sktop+29 [d:\w8rtm\shell\twinui\appmanager\lib\appmanager.cp p @ 4999] 000007ff`3c8f0849 488b07 mov rax,qword ptr [rdi] NTGLOBALFLAG: 0 APPLICATION_VERIFIER_FLAGS: 0 APP: explorer.exe FAULTING_LOCAL_VARIABLE_NAME: hwndZbidDesktop MANAGED_STACK: !dumpstack -EE No export dumpstack found PRIMARY_PROBLEM_CLASS: WRONG_SYMBOLS BUGCHECK_STR: APPLICATION_FAULT_WRONG_SYMBOLS LAST_CONTROL_TRANSFER: from 000007ff3c9cddb5 to 000007ff3c8f0849 STACK_TEXT: 00000000`03acf390 000007ff`3c9cddb5 : 00000000`03acf480 00000000`03acf500 00000000`00000001 00000000`00000001 : twinui!CApplicationManager::_TryChangeSystemModeDe sktop+0x29 00000000`03acf3e0 000007ff`3c5f544d : 00000000`0000001e 00000000`03acf540 00000000`00000000 00000000`00000000 : twinui!CApplicationManager::_HandleWindowChangedOw ner+0x3d8955 00000000`03acf440 000007ff`3c5b232a : 00000000`00000001 00000000`00050216 00000000`0000c02b 000007ff`3c5b1820 : twinui!CApplicationManager::OnShellHookMessage+0x4 26 00000000`03acf720 000007ff`4f93171e : 00000000`00050216 00000000`0000c02b 00000000`0000001e 00000000`0036069e : twinui!CImmersiveWindowMessageService::s_MessageMs gWndProc+0x336 00000000`03acf830 000007ff`4f9314d7 : 00000000`008311c0 00000000`03acf9a0 000007f7`579e6800 000007ff`3c5b1ff0 : user32!UserCallWinProcCheckWow+0x13a 00000000`03acf8f0 000007ff`4b981264 : 00000000`0046cfa0 00000000`0046cfa0 00000000`00000000 00000000`00000000 : user32!DispatchMessageWorker+0x1a7 00000000`03acf970 000007ff`4b9835c0 : 00000000`00000045 00000000`00466d40 00000000`00000000 00000000`00000000 : windows_immersiveshell_serviceprovider!CImmersiveS hellController::_ImmersiveShellComponentsThreadPro cInternal+0x2a6 00000000`03acfa10 000007ff`4f7f167e : 000007ff`4b980000 00000000`00000000 00000000`00000000 00000000`00000000 : windows_immersiveshell_serviceprovider!CImmersiveS hellController::s_ImmersiveShellComponentsThreadPr oc+0x75 00000000`03acfa40 000007ff`514bc3f1 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : kernel32!BaseThreadInitThunk+0x1a 00000000`03acfa70 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x1d STACK_COMMAND: ~4s; .ecxr ; kb FAULTING_SOURCE_LINE: d:\w8rtm\shell\twinui\appmanager\lib\appmanager.cp p FAULTING_SOURCE_FILE: d:\w8rtm\shell\twinui\appmanager\lib\appmanager.cp p FAULTING_SOURCE_LINE_NUMBER: 4999 SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: twinui!CApplicationManager::_TryChangeSystemModeDe sktop+29 FOLLOWUP_NAME: MachineOwner MODULE_NAME: twinui IMAGE_NAME: twinui.dll DEBUG_FLR_IMAGE_TIMESTAMP: 50109442 FAILURE_BUCKET_ID: WRONG_SYMBOLS_c0000005_twinui.dll!CApplicationMana ger::_TryChangeSystemModeDesktop BUCKET_ID: APPLICATION_FAULT_WRONG_SYMBOLS_twinui!CApplicatio nManager::_TryChangeSystemModeDesktop+29 WATSON_STAGEONE_URL: http://watson.microsoft.com/StageOne...htm?Retriage=1 Followup: MachineOwner --------- 0:004> lmvm twinui start end module name 000007ff`3c5b0000 000007ff`3cf57000 twinui (private pdb symbols) c:\symbols\twinui.pdb\4F7F380EBAD34576834CB628C754 C82E2\twinui.pdb Loaded symbol image file: twinui.dll Image path: C:\Windows\System32\twinui.dll Image name: twinui.dll Timestamp: Wed Jul 25 20:50:10 2012 (50109442) CheckSum: 009A014E ImageSize: 009A7000 File version: 6.2.9200.16384 Product version: 6.2.9200.16384 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 2.0 Dll File date: 00000000.00000000 Translations: 0409.04b0 CompanyName: Microsoft Corporation ProductName: Microsoft® Windows® Operating System InternalName: TWINUI OriginalFilename: TWINUI.dll ProductVersion: 6.2.9200.16384 FileVersion: 6.2.9200.16384 (win8_rtm.120725-1247) FileDescription: TWINUI LegalCopyright: © Microsoft Corporation. All rights reserved.